A stranger could take your site tonight.

If your site runs PHP without this week's fix, one request from a stranger can be enough to take it over, with everything your clients typed into it. The US cyber-security agency CISA says to patch immediately. We rebuild your same site with no PHP in it, live within one business day, for US$1,200. A PHP flaw can never reach it again.

Five shiny seal badges, each with its condition beside it: SSL Secured (HTTPS on every page), PHP Free (no PHP in your new site), Money Back Guarantee (every dollar back if we leave PHP), Secure Checkout (payments by Stripe) and Live in 1 Day (within one business day).

In Canada? The same offer in Canadian dollars.

This site isn't yours anymore.

• Their code runs on your server.
• They read what your clients typed into your forms.
• They send phishing in your name.
• Clients' credit RUINED by people pretending to be you.
• Clients' PRIVATE medical records SOLD online.

› One request from a stranger.
‹ The server runs it.
‹ Form messages read: 214
‹ Client emails copied: 1,206
‹ Phishing sent in your name: 3,850

Acted out on WordPress.org's demo page. The counts are made up.

On PHP, waiting for a patch

Until your host installs the fix, and again at the next flaw. What to send your host

Still yours.

› The same request.
‹ Nothing here runs. Ignored.

The same page, off PHP

Plain files. There's nothing behind them for a PHP flaw to reach. How we do it

Same page, without PHP. Not one pixel changed.

Acted out on WordPress.org's Twenty Twenty-Four theme demo, with made-up counts; nothing was attacked. The two pages themselves are real: top to bottom, 0 of 7,472,640 pixels differ between the original and our plain-file copy on a desktop, and 0 of 2,110,680 on a phone, both read 21 October 2026.

Two copies of the same page, acted out on WordPress.org's Twenty Twenty-Four theme demo with made-up counts; nothing was attacked. First the PHP side, "On PHP, waiting for a patch": one request from a stranger arrives, the server runs it, and the page tears, flashes and goes dark: "This site isn't yours anymore. Their code runs on your server. They read what your clients typed into your forms. They send phishing in your name." Its log counts up with invented numbers (form messages read, client emails copied, phishing sent in your name), then the stakes land: clients' credit ruined, clients' private medical records sold online. Then the plain-file side, "The same page, off PHP": the same request arrives, nothing runs, a golden shield rises and a check mark draws in, the page glows gold, and it reads "Still yours." The two pages look identical to the pixel before the request.

Your host may patch it this week, or they may not. You can't tell from the outside, and the first person to notice could be a client. Check your site free in a minute.

What a stranger can do with your site

On Tuesday, the people who make PHP told site owners to update or take their sites down. Government sites in the Netherlands, Finland and France went dark the next day. Attack code is already out.

Is this you? If your site is built on WordPress, it runs PHP. If it's on Squarespace or Wix, this one isn't yours to fix. In Canada, where we checked, 9 in 10 business sites that show their PHP version are missing the fix.

They don't need your password. One request can be enough.

They can take what's on the server. That includes what your clients typed into your forms.

They're already trying. Cloudflare said on Wednesday that attacks were emerging. CISA, the US cyber-security agency, says to patch immediately.

What fixes it. Your host has to install an update, and you can't see from outside whether they have. Here's what to send your host. Or stop depending on them.

Sources: CERT-EU, CISA, and Cloudflare and the government shutdowns (via CNBC).

Get off PHP for good

We copy every page of your site, with its words, photos and layout. Then we rebuild it as plain files. A plain file is like a printed brochure: people can read it, but nothing in it can run. So a PHP flaw has nothing to grab.

The same WordPress demo page on a phone, the original and our plain-file copy side by side. They are identical: 0 of 2,110,680 pixels differ.

Your clients see the same site. Every page keeps its address, so Google still sends people to the same pages. Your contact form keeps working. Your new site is served by Cloudflare, with HTTPS on every page.

Here's what you get

Get email that still works.

...so you can stop worrying that client emails will vanish.

Get a folder that proves it.

...so you can stop dreading the question "What did you do about it?"

Get the note for your insurer or licensing body, already written.

...so you can stop drafting it at midnight.

Get the keys: your files and your web address, in your name.

...so you can stop being held hostage by a web company.

Get a plan for leaving your old host.

...so you can stop paying an old host for years because cancelling felt risky.

Get all of it in plain text, for your own AI.

...so you can stop retyping our work.

We trust our own site to it

This site is built the same way, with no PHP anywhere.

HTTP/2 200
content-type: text/html
server: cloudflare
cache-control: public, max-age=0, must-revalidate
x-content-type-options: nosniff

$ curl -s -o /dev/null -w "%{http_code}" https://www.mackenziebowes.com/wp-login.php
404
$ curl -s -o /dev/null -w "%{http_code}" https://www.mackenziebowes.com/index.php
404

A hidden PHP line isn't proof on its own, since most PHP sites hide theirs. Your folder is the proof: none of its files is PHP.

Who's fixing your site

Mackenzie Bowes. Ten years building websites. About

The team behind BuildCanada.com trusted us with their site. It's the policy non-profit backed by the founders of Shopify and Cohere. Their pages went from 20 seconds to load to under 2. The story

“I’m so glad you went the extra mile to build that.”

Brendan Samek, lead engineer, Build Canada

How can we do this so fast?

Mackenzie runs a software factory staffed by AI agents built on Claude, Anthropic's AI. Each agent has one job: research, writing, design, building or checking.

1. This week, they read more than 10,000 Canadian practice websites to measure this flaw.
2. They built this page in one evening, the night the news broke.
3. Copying a 25-page site to plain files takes them about a minute.

The machines do the copying. Mackenzie checks every site before it goes live.

Attackers didn't wait for the news

Matthew Prince, Cloudflare's CEO, posted the numbers on Wednesday:

“In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”

Matthew Prince, CEO, Cloudflare, on X

Thousands of tries before anyone knew. Millions now. Attacks like these sweep the web automatically, so your site doesn't need to be famous to be tried.

One business day, three steps

1. Pay the deposit to book your spot. The checkout asks for your web address.
2. Give us access to your web address. That's the login where you bought it, like GoDaddy or Namecheap. Or put us on a call with whoever has it. Your one business day starts here.
3. Click through your new site, then we switch it on. Mackenzie checks every site before it goes live. You get your folder and your notes.

What you pay

US$1,200, once.

1. US$600 to book your spot.
2. US$600 when you approve your new site.

Three seals: PHP free, with no PHP in your new site; money-back guarantee, every dollar back if we leave PHP; live within one business day.

For sites up to 30 pages. Bigger sites, shops, logins and patient portals get a quote first, and your deposit counts toward it.

Optional care: US$49 a month. We host your site, check it for PHP every month, and make two small changes a month, each live within one business day. Or host your folder yourself, often for free.

One PHP file, and you pay nothing

If you find a single PHP file in your site's folder, or a page of your site that runs PHP, we refund every dollar you paid.

Questions

Will my email stop working?

No. Your email will still work. We check that mail still arrives before we finish.

Will I drop in Google?

Every page keeps its address, so Google's links still work. No one can promise a ranking, and we won't.

My host says they've patched. Do I still need this?

Maybe not this week. But the next PHP flaw will need another patch from them. A site with no PHP has nothing to patch.

I edit my site myself in WordPress. Can I keep doing that?

No, because the WordPress editor is the part that runs PHP. Send us the change instead. With care, it's live within one business day.

My site has a shop, member logins or a patient portal.

Those need software running on a server, so they're a bigger job. We'll quote it, and your deposit counts toward it.

Why does this cost less than a hand-built site?

We copy the design you already have. A hand-built site is a new design, for US$3,500.

Why Rust?

The program that builds your pages is written in Rust, a language built to rule out a whole family of security bugs. What you get from it is plain files, and plain files run nothing.

Stop waiting on your host

Book your spot now. One business day after we have access, a PHP flaw stops being your problem.